Critical severity · published Nov 25, 2022
CVE-2022-45476
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download
9.8
CVSS
1%
EPSS
No
On KEV
Description
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tiny File Manager · Prasathmani
2.4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45476
Exploit
https://fluidattacks.com/advisories/mosey/
Product
https://github.com/prasathmani/tinyfilemanager/
More from Tiny File Manager
9.8
CVE-2022-40916
Tiny File Manager v2.4.7 and below is vulnerable to session fixation
9.8
CVE-2022-1000
Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7
8.8
CVE-2022-23044
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application
8.8
CVE-2021-45010
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to…
8.8
CVE-2021-40965
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by…